CVE-2026-47875
JobParameterDeserializer bypasses the trusted-type allowlist
CVE-2026-47875 is a medium vulnerability (CVSS 5.6) in Broadcom Spring Batch, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 36th percentile. Fixed in org.springframework.batch:spring-batch-core 5.2.6-tuxcare.3.
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
JobParameterDeserializer bypasses the trusted-type allowlist
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6
- Record
CVE-2026-47875- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2026-66839
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6
- Record
EUVD-2026-66839- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mvcx-qg6f-j67g
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer...
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6
- Record
GHSA-mvcx-qg6f-j67g- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6
- Record
CVE-2026-47875- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVCLSA-2026-1791917708 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.2.6-tuxcare.3.
- Record
CLSA-2026-1791917708- Updated
- 2026-11-02
OSVCLSA-2026-1791954798 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 5.1.3-tuxcare.6.
- Record
CLSA-2026-1791954798- Updated
- 2026-11-02
OSVCLSA-2026-1791957369 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.2.4-tuxcare.1.
- Record
CLSA-2026-1791957369- Updated
- 2026-11-02
OSVCLSA-2026-1791966597 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.1.2-tuxcare.5.
- Record
CLSA-2026-1791966597- Updated
- 2026-11-02
OSVCLSA-2026-1791967355 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.0.4-tuxcare.1.
- Record
CLSA-2026-1791967355- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.batch:spring-batch-coreTuxCare:Maven |
5.2.6 up to 5.2.6-tuxcare.3, plus listed versions 5.2.6-tuxcare.15.2.6-tuxcare.2 |
5.2.6-tuxcare.3 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
5.2.6 up to 5.2.6-tuxcare.3, plus listed versions 5.2.6-tuxcare.15.2.6-tuxcare.2 |
5.2.6-tuxcare.3 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
5.1.3 up to 5.1.3-tuxcare.6, plus listed versions 5.1.3-tuxcare.15.1.3-tuxcare.25.1.3-tuxcare.35.1.3-tuxcare.45.1.3-tuxcare.5 |
5.1.3-tuxcare.6 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
5.1.3 up to 5.1.3-tuxcare.6, plus listed versions 5.1.3-tuxcare.15.1.3-tuxcare.25.1.3-tuxcare.35.1.3-tuxcare.45.1.3-tuxcare.5 |
5.1.3-tuxcare.6 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
5.1.2 up to 5.1.2-tuxcare.5, plus listed versions 5.1.2-tuxcare.15.1.2-tuxcare.25.1.2-tuxcare.35.1.2-tuxcare.4 |
5.1.2-tuxcare.5 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
5.1.2 up to 5.1.2-tuxcare.5, plus listed versions 5.1.2-tuxcare.15.1.2-tuxcare.25.1.2-tuxcare.35.1.2-tuxcare.4 |
5.1.2-tuxcare.5 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
5.0.4 up to 5.0.4-tuxcare.1 | 5.0.4-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
5.0.4 up to 5.0.4-tuxcare.1 | 5.0.4-tuxcare.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | affected, aliases, products, published | EUVD, OSV |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |